What is external code execution in the insecure-external-code-execution option on Dependabot?

[yykamei]

Select Topic Area

Question

Body

In some package-ecosystem, we have to configure registries as well as insecure-external-code-execution to allow in order to let Dependabot access the private registries. If the two configurations are properly set, the document says like this:

external code execution that occurs will only have access to the package managers in the registries associated with that updates setting.

I'm curious what is external code execution in this explanation. I created a Ruby Gem that triggers an HTTP request when it's installed (the code is here), but it looks like not being prevented from accessing an external server. Even though I set insecure-external-code-execution to deny, Dependabot seemed to provoke an HTTP request; I expected Dependabot would fail. I wonder what is external code execution. What's the purpose of insecure-external-code-execution?

Thanks,

[yykamei]

Thank you! Do you know what is "external code execution"? I tried this code in my Ruby Gem to perform "external code execution", and it ran successfully even though insecure-external-code-execution is configured as deny. Isn't this an "external code execution"?

[bogn83]

We are also puzzled about the actual effects and concrete risks to e.g. GITHUB_TOKEN of the repo that dependabot is running for.

Here are the concrete questions:

• Is GITHUB_TOKEN of the current repository also part of those stealable credentials OR STRICTLY ONLY what was entered with the Dependabot secrets UI?
• How are the secrets injected into dependabot, can an attackers simply enumerate them or do they need to know the name of the secret?

[joevin-slq-docto]

@bogn83 @yykamei you can understand why unexpected_external_code can be raised by reading this:

• https://github.com/dependabot/dependabot-core/blob/main/bundler/lib/dependabot/bundler/file_parser.rb#L37-L45
• https://github.com/dependabot/dependabot-core/blob/main/bundler/spec/dependabot/bundler/file_parser_spec.rb#L333-L359

[yykamei]

Thank you. This is very helpful.